1. Copyright © 2015 Pearson Education, Inc. Chapter 2 Chapter 2

2. Copyright © 2015 Pearson Education, Inc. 2-2  Justify the need for formal management processes.  Explain the plan–protect–respond security management cycle.  Describe compliance laws and regulations.  Describe organizational security issues.  Describe risk analysis.  Describe technical security infrastructure.  Explain policy-driven implementation.  Know governance frameworks. 2

3. Copyright © 2015 Pearson Education, Inc. 2-3

4. Copyright © 2015 Pearson Education, Inc. 2-4  The first chapter focused on threats  The rest of the book focuses on defense  In this chapter, we will see that defensive thinking is build around the plan-protect- respond cycle  In this chapter, we will focus on planning  Chapters 3 to 9 focus on protection  Chapter 10 focuses on response

5. Copyright © 2015 Pearson Education, Inc. 2-5 5

6. Copyright © 2015 Pearson Education, Inc. 2-6 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 6

7. Copyright © 2015 Pearson Education, Inc. 2-7  Technology Is Concrete ◦ Can visualize devices and transmission lines ◦ Can understand device and software operation  Management Is Abstract  Management Is More Important ◦ Security is a process, not a product (Bruce Schneier) 7

8. Copyright © 2015 Pearson Education, Inc. 2-8 8

9. Copyright © 2015 Pearson Education, Inc. 2-9 9 A failure in any component will lead to failure for the entire system

10. Copyright © 2015 Pearson Education, Inc. 2-10  Complex ◦ Cannot be managed informally  Need Formal Processes ◦ Planned series of actions in security management ◦ Annual planning ◦ Processes for planning and developing individual countermeasures 10

11. Copyright © 2015 Pearson Education, Inc. 2-11  A Continuous Process ◦ Fail if let up  Compliance Regulations ◦ Add to the need to adopt disciplined security management processes 11

12. Copyright © 2015 Pearson Education, Inc. 2-12 12 Dominates security management thinking

13. Copyright © 2015 Pearson Education, Inc. 2-13 13 The systems life cycle goes beyond the SDLC (System Development Life Cycle), to include operational use. SLC (System Life Cycle) thinking is critical in security.

14. Copyright © 2015 Pearson Education, Inc. 2-14  Vision ◦ Your understanding about your role with respect to your company, its employees, and the outside world drives everything else 14

15. Copyright © 2015 Pearson Education, Inc. 2-15  Security as an Enabler ◦ Security is often thought of as a preventer ◦ But security is also an enabler ◦ A company with good security can do things otherwise impossible  Engage in interorganizational systems with other firms  Can use SNMP SET commands (DOS command tool) to manage systems remotely ◦ Must get in early on projects to reduce inconvenience 15

16. Copyright © 2015 Pearson Education, Inc. 2-16  Positive Vision of Users ◦ Must not view users as malicious or stupid ◦ Stupid means poorly trained, and that is security’s fault ◦ Must have zero tolerance for negative views of users 16

17. Copyright © 2015 Pearson Education, Inc. 2-17  Should Not View Security as Police or Military Force ◦ Creates a negative view of users ◦ Police merely punish, they do not prevent crime; security must prevent attacks ◦ Military can use fatal force; security cannot even punish (HR does that) 17

18. Copyright © 2015 Pearson Education, Inc. 2-18  Need New Vision ◦ Mother nurturing inexperienced offspring  Cannot Be Effective Unless Users Work with You ◦ Consultation, consultation, consultation 18

19. Copyright © 2015 Pearson Education, Inc. 2-19  Identify Current IT Security Gaps  Identify Driving Forces ◦ The threat environment ◦ Compliance laws and regulations ◦ Corporate structure changes, such as mergers  Identify Corporate Resources Needing Protection ◦ Enumerate all resources ◦ Rate each by sensitivity 19

20. Copyright © 2015 Pearson Education, Inc. 2-20  Develop Remediation Plans (Sample)Sample ◦ Develop a remediation plan for all security gaps ◦ Develop a remediation plan for every resource unless it is well protected  Develop an Investment Portfolio ◦ You cannot close all gaps immediately ◦ Choose projects (security projects) that will provide the largest returns ◦ Implement these 20

21. Copyright © 2015 Pearson Education, Inc. 2-21 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 21

22. Copyright © 2015 Pearson Education, Inc. 2-22  Compliance Laws and Regulations ◦ Compliance laws and regulations create requirements for corporate security  Documentation requirements are strong  Identity management requirements tend to be strong ◦ Compliance can be expensive ◦ There are many compliance laws and regulations, and the number is increasing rapidly 22

23. Copyright © 2015 Pearson Education, Inc. 2-23  Sarbanes–Oxley Act of 2002 ◦ Massive corporate financial frauds in 2002 ◦ Act requires firm to report material deficiencies in financial reporting processes ◦ Material deficiency a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected 23

24. Copyright © 2015 Pearson Education, Inc. 2-24  Sarbanes–Oxley Act of 2002 ◦ Note that it does not matter whether a material misstatement actually occurs—merely that there is more than a remote likelihood that it could occur and not be detected ◦ A material deviation is a mere 5% deviation ◦ Companies that report material deficiencies typically find that their stock loses value, and the chief financial officer may lose his or her job 24

25. Copyright © 2015 Pearson Education, Inc. 2-25  Privacy Protection Laws ◦ The European Union (E.U.) Data Protection Directive of 2002 ◦ Many other nations have strong commercial data privacy laws ◦ The U.S. Gramm–Leach–Bliley Act (GLBA) ◦ The U.S. Health Insurance Portability and Accountability Act (HIPAA) for private data in health care organizations 25

26. Copyright © 2015 Pearson Education, Inc. 2-26  Data Breach Notification Laws ◦ California’s SB 1386 ◦ Requires notification of any California citizen whose private information is exposed ◦ Companies cannot hide data breaches anymore  Federal Trade Commission (FTC) ◦ Can punish companies that fail to protect private information ◦ Fines and required external auditing for several years 26

27. Copyright © 2015 Pearson Education, Inc. 2-27  Industry Accreditation ◦ For hospitals, etc. ◦ Often have to security requirements  PCS-DSS ◦ Payment Card Industry–Data Security Standards ◦ Applies to all firms that accept credit cards ◦ Has 12 general requirements, each with specific subrequirements 27

28. Copyright © 2015 Pearson Education, Inc. 2-28  FISMA ◦ Federal Information Security Management Act of 2002 ◦ Processes for all information systems used or operated by a U.S. government federal agencies ◦ Also by any contractor or other organization on behalf of a U.S. government agency ◦ Certification, followed by accreditation ◦ Continuous monitoring ◦ Criticized for focusing on documentation instead of protection 28

29. Copyright © 2015 Pearson Education, Inc. 2-29 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 29

30. Copyright © 2015 Pearson Education, Inc. 2-30  Chief Security Officer (CSO) ◦ Also called chief information security officer (CISO)  Where to Locate IT Security? ◦ Within IT  Compatible technical skills  CIO will be responsible for security ◦ Outside of IT  Gives independence  Hard to blow the whistle on IT and the CIO  This is the most commonly advised choice 30

31. Copyright © 2015 Pearson Education, Inc. 2-31  Where to Locate IT Security? ◦ Hybrid  Place planning, policy making, and auditing outside of IT  Place operational aspects such as firewall operation within IT 31

32. Copyright © 2015 Pearson Education, Inc. 2-32  Top Management Support ◦ Budget ◦ Support in conflicts ◦ Setting personal examples 32

33. Copyright © 2015 Pearson Education, Inc. 2-33  Relationships with Other Departments ◦ Special relationships  Ethics, compliance, and privacy officers  Human resources (training, hiring, terminations, sanction violators)  Legal department 33

34. Copyright © 2015 Pearson Education, Inc. 2-34  Relationships with Other Departments ◦ Special relationships  Auditing departments  IT auditing, internal auditing, financial auditing  Might place security auditing under one of these  This would give independence from the security function  Facilities (buildings) management  Uniformed security 34

35. Copyright © 2015 Pearson Education, Inc. 2-35  Relationships with Other Departments ◦ All corporate departments  Cannot merely toss policies over the wall ◦ Business partners  Must link IT corporate systems together  Before doing so, must exercise due diligence in assessing their security 35

36. Copyright © 2015 Pearson Education, Inc. 2-36  Outsourcing IT Security ◦ Only e-mail or webservice ◦ Managed Security Service Providers (MSSPs)  Outsource most IT security functions to the MSSP  But usually not policy 36

37. Copyright © 2015 Pearson Education, Inc. 2-37 37

38. Copyright © 2015 Pearson Education, Inc. 2-38 38

39. Copyright © 2015 Pearson Education, Inc. 2-39 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 39

40. Copyright © 2015 Pearson Education, Inc. 2-40  Realities ◦ Can never eliminate risk ◦ “Information assurance” is impossible  Risk Analysis ◦ Goal is reasonable risk ◦ Risk analysis weighs the probable cost of compromises against the costs of countermeasures ◦ Also, security has negative side effects that must be weighed 40

41. Copyright © 2015 Pearson Education, Inc. 2-41 Single Loss Expectancy (SLE) Annualized Loss Expectancy (ALE)  Asset Value (AV)  X Exposure Factor (EF) ◦ Percentage loss in asset value if a compromise occurs  = Single Loss Expectancy (SLE) ◦ Expected loss in case of a compromise  SLE  X Annualized Rate of Occurrence (ARO) ◦ Annual probability of a compromise  = Annualized Loss Expectancy (ALE) ◦ Expected loss per year from this type of compromise Not included

42. Copyright © 2015 Pearson Education, Inc. 2-42 42 Base Case Countermeasure A Asset Value (AV)$100,000 Exposure Factor (EF)80%20% Single Loss Expectancy (SLE): = AV*EF$80,000$20,000 Annualized Rate of Occurrence (ARO)50% Annualized Loss Expectancy (ALE): = SLE*ARO$40,000$10,000 ALE Reduction for CountermeasureNA$30,000 Annualized Countermeasure CostNA$17,000 Annualized Net Countermeasure ValueNA$13,000 Not included

43. Copyright © 2015 Pearson Education, Inc. 2-43 43 Base Case Countermeasure A Asset Value (AV)$100,000 Exposure Factor (EF)80%20% Single Loss Expectancy (SLE): = AV*EF$80,000$20,000 Annualized Rate of Occurrence (ARO)50% Annualized Loss Expectancy (ALE): = SLE*ARO$40,000$10,000 ALE Reduction for CountermeasureNA$30,000 Annualized Countermeasure CostNA$17,000 Annualized Net Countermeasure ValueNA$13,000 Countermeasure A should reduce the exposure factor by 75% Not included

44. Copyright © 2015 Pearson Education, Inc. 2-44 44 Base Case Countermeasure B Asset Value (AV)$100,000 Exposure Factor (EF)80% Single Loss Expectancy (SLE): = AV*EF$80,000 Annualized Rate of Occurrence (ARO)50%25% Annualized Loss Expectancy (ALE): = SLE*ARO$40,000$20,000 ALE Reduction for CountermeasureNA$20,000 Annualized Countermeasure CostNA$4,000 Annualized Net Countermeasure ValueNA$16,000 Not included

45. Copyright © 2015 Pearson Education, Inc. 2-45 45 Base Case Countermeasure B Asset Value (AV)$100,000 Exposure Factor (EF)80% Single Loss Expectancy (SLE): = AV*EF$80,000 Annualized Rate of Occurrence (ARO)50%25% Annualized Loss Expectancy (ALE): = SLE*ARO$40,000$20,000 ALE Reduction for CountermeasureNA$20,000 Annualized Countermeasure CostNA$4,000 Annualized Net Countermeasure ValueNA$16,000 Countermeasure B should cut the frequency of compromises in half Not included

46. Copyright © 2015 Pearson Education, Inc. 2-46 46 Base Case Countermeasure AB Asset Value (AV)$100,000 Exposure Factor (EF)80%20%80% Single Loss Expectancy (SLE): = AV*EF$80,000$20,000$80,000 Annualized Rate of Occurrence (ARO)50% 25% Annualized Loss Expectancy (ALE): = SLE*ARO$40,000$10,000$20,000 ALE Reduction for CountermeasureNA$30,000$20,000 Annualized Countermeasure CostNA$17,000$4,000 Annualized Net Countermeasure ValueNA$13,000$16,000 Not included

47. Copyright © 2015 Pearson Education, Inc. 2-47 47 Base Case Countermeasure AB Asset Value (AV)$100,000 Exposure Factor (EF)80%20%80% Single Loss Expectancy (SLE): = AV*EF$80,000$20,000$80,000 Annualized Rate of Occurrence (ARO)50% 25% Annualized Loss Expectancy (ALE): = SLE*ARO$40,000$10,000$20,000 ALE Reduction for CountermeasureNA$30,000$20,000 Annualized Countermeasure CostNA$17,000$4,000 Annualized Net Countermeasure ValueNA$13,000$16,000 Although Countermeasure A reduces the ALE more, Countermeasure B is much less expensive. The annualized net countermeasure value for B is larger. The company should select Countermeasure B. Although Countermeasure A reduces the ALE more, Countermeasure B is much less expensive. The annualized net countermeasure value for B is larger. The company should select Countermeasure B. Not included

48. Copyright © 2015 Pearson Education, Inc. 2-48  Uneven Multiyear Cash Flows ◦ For both attack costs and defense costs ◦ Must compute the return on investment (ROI) using discounted cash flows ◦ Net present value (NPV) or internal rate of return (ROI) 48 Not included

49. Copyright © 2015 Pearson Education, Inc. 2-49  Total Cost of Incident (TCI) ◦ Exposure factor in classic risk analysis assumes that a percentage of the asset is lost ◦ In most cases, damage does not come from asset loss ◦ For instance, if personally identifiable information is stolen, the cost is enormous but the asset remains ◦ Must compute the total cost of incident (TCI) ◦ Include the cost of repairs, lawsuits, and many other factors 49 Not included

50. Copyright © 2015 Pearson Education, Inc. 2-50  Many-to-Many Relationships between Countermeasures and Resources ◦ Classic risk analysis assumes that one countermeasure protects one resource ◦ Single countermeasures, such as a firewall, often protect many resources ◦ Single resources, such as data on a server, are often protected by multiple countermeasures ◦ Extending classic risk analysis is difficult 50 Not included

51. Copyright © 2015 Pearson Education, Inc. 2-51  Impossibility of Knowing the Annualized Rate of Occurrence ◦ There simply is no way to estimate this ◦ This is the worst problem with classic risk analysis ◦ As a consequence, firms too often merely rate their resources by risk level 51 Not included

52. Copyright © 2015 Pearson Education, Inc. 2-52  Problems with “Hard-Headed Thinking” ◦ Security benefits are difficult to quantify ◦ If only support “hard numbers,” may underinvest in security 52 Not included

53. Copyright © 2015 Pearson Education, Inc. 2-53  Perspective ◦ Impossible to do perfectly ◦ Must be done as well as possible ◦ Identifies key considerations ◦ Works if countermeasure value is very large or very negative ◦ But never take classic risk analysis seriously 53 Not included

54. Copyright © 2015 Pearson Education, Inc. 2-54  Risk Reduction  Risk Acceptance  Risk Transference  Risk Avoidance 54

55. Copyright © 2015 Pearson Education, Inc. 2-55  Risk Reduction  Risk Acceptance  Risk Transference  Risk Avoidance 55

56. Copyright © 2015 Pearson Education, Inc. 2-56  Risk Reduction ◦ The approach most people consider ◦ Install countermeasures to reduce harm ◦ Makes sense only if risk analysis justifies the countermeasure  Risk Acceptance ◦ If protecting against a loss would be too expensive, accept losses when they occur ◦ Good for small unlikely losses ◦ Good for large but rare losses 56

57. Copyright © 2015 Pearson Education, Inc. 2-57  Risk Reduction  Risk Acceptance  Risk Transference  Risk Avoidance 57

58. Copyright © 2015 Pearson Education, Inc. 2-58  Risk Transference ◦ Buy insurance against security-related losses ◦ Especially good for rare but extremely damaging attacks ◦ Does not mean a company can avoid working on IT security ◦ If bad security, will not be insurable ◦ With better security, will pay lower premiums 58

59. Copyright © 2015 Pearson Education, Inc. 2-59  Risk Reduction  Risk Acceptance  Risk Transference  Risk Avoidance 59

60. Copyright © 2015 Pearson Education, Inc. 2-60  Risk Avoidance ◦ Not to take a risky action ◦ Lose the benefits of the action ◦ May cause anger against IT security  Recap: Four Choices When You Face Risk ◦ Risk reduction ◦ Risk acceptance ◦ Risk transference ◦ Risk avoidance 60

61. Copyright © 2015 Pearson Education, Inc. 2-61 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 61

62. Copyright © 2015 Pearson Education, Inc. 2-62  Technical Security Architectures ◦ Definition  All of a company’s technical countermeasures  How these countermeasures are organized  Into a complete system of protection ◦ Architectural decisions  Based on the big picture  Must be well planned to provide strong security with few weaknesses 62

63. Copyright © 2015 Pearson Education, Inc. 2-63 63

64. Copyright © 2015 Pearson Education, Inc. 2-64  Technical Security Architectures ◦ Dealing with legacy technologies  Legacy technologies are technologies put in place previously  Too expensive to upgrade all legacy technologies immediately  Must upgrade if seriously impairs security  Upgrades must justify their costs 64

65. Copyright © 2015 Pearson Education, Inc. 2-65  Principles ◦ Defense in depth  Resource is guarded by several countermeasures in series  Attacker must breach them all, in series, to succeed  If one countermeasure fails, the resource remains safe 65

66. Copyright © 2015 Pearson Education, Inc. 2-66  Principles ◦ Defense in depth versus weakest links  Defense in depth: multiple independent countermeasures that must be defeated in series  Weakest link: a single countermeasure with multiple interdependent components that must all succeed for the countermeasure to succeed 66

67. Copyright © 2015 Pearson Education, Inc. 2-67  Principles ◦ Avoiding single points of vulnerability  Failure at a single point can have drastic consequences  DNS servers, central security management servers, etc. 67

68. Copyright © 2015 Pearson Education, Inc. 2-68  Principles ◦ Minimizing security burdens ◦ Realistic goals  Cannot change a company’s protection level overnight  Mature as quickly as possible 68

69. Copyright © 2015 Pearson Education, Inc. 2-69  Elements of a Technical Security Architecture ◦ Border management ◦ Internal site management ◦ Management of remote connections ◦ Interorganizational systems with other firms ◦ Centralized security management  Increases the speed of actions  Reduces the cost of actions 69

70. Copyright © 2015 Pearson Education, Inc. 2-70 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 70

71. Copyright © 2015 Pearson Education, Inc. 2-71  Policies ◦ Statements of what is to be done ◦ Provide clarity and direction ◦ Does not specify in detail how the policy is to be implemented in specific circumstances ◦ Allows the best possible implementation at any time ◦ Vary widely in length 71

72. Copyright © 2015 Pearson Education, Inc. 2-72  Tiers of Security Policies ◦ Brief corporate security policy to drive everything ◦ Major policies  E-mail  Hiring and firing  Personally identifiable information  … 72

73. Copyright © 2015 Pearson Education, Inc. 2-73  Tiers of Security Policies ◦ Acceptable use policy  Summarizes key points of special importance for users  Typically, must be signed by users ◦ Policies for specific countermeasures  Again, separates security goals from implementation 73

74. Copyright © 2015 Pearson Education, Inc. 2-74  Writing Policies ◦ For important policies, IT security cannot act alone ◦ There should be policy-writing teams for each policy ◦ For broad policies, teams must include IT security, management in affected departments, the legal department, and so forth ◦ The team approach gives authority to policies ◦ It also prevents mistakes because of IT security’s limited viewpoint 74

75. Copyright © 2015 Pearson Education, Inc. 2-75 75

76. Copyright © 2015 Pearson Education, Inc. 2-76  Implementation Guidance ◦ Limits the discretion of implementers in order to simplify implementation decisions and avoid bad choices in interpreting policies  None ◦ Implementer is only guided by the policy itself  Standards versus Guidelines ◦ Standards are mandatory directives ◦ Guidelines are not mandatory but must be considered 76

77. Copyright © 2015 Pearson Education, Inc. 2-77  Types of Implementation Guidance ◦ Procedures: detailed specifications for how something should be done  Can be either standards or guidelines  Segregation of duties: two people are required to complete sensitive tasks  In movie theaters, one sells tickets and the other takes tickets  No individual can do damage 77

78. Copyright © 2015 Pearson Education, Inc. 2-78  Types of Implementation Guidance ◦ Procedures  Request/authorization control  Limit the number of people who may make requests on sensitive matters  Allow even fewer to be able to authorize requests  Authorizer must never be the requester  Mandatory vacations to uncover schemes that require constant maintenance  Job rotation to uncover schemes that require constant maintenance 78

79. Copyright © 2015 Pearson Education, Inc. 2-79  Types of Implementation Guidance ◦ Procedures: detailed descriptions of what should be done ◦ Processes: less detailed specifications of what actions should be taken  Necessary in managerial and professional business function ◦ Baselines: checklists of what should be done but not the process or procedures for doing them 79

80. Copyright © 2015 Pearson Education, Inc. 2-80  Types of Implementation Guidance ◦ Best practices: most appropriate actions in other companies ◦ Recommended practices: normative guidance ◦ Accountability  Owner of resource is accountable  Implementing the policy can be delegated to a trustee, but accountability cannot be delegated ◦ Codes of ethics 80

81. Copyright © 2015 Pearson Education, Inc. 2-81  Ethics ◦ A person’s system of values ◦ Needed in complex situations ◦ Different people may make different decisions in the same situation ◦ Companies create codes of ethics to give guidance in ethical decisions 81

82. Copyright © 2015 Pearson Education, Inc. 2-82  Code of Ethics: Typical Contents (Partial List) ◦ Important for having a good workplace and to avoid damaging a firm’s reputation ◦ Applies to everybody  Senior managers usually have additional requirements ◦ Improper ethics can result in sanctions, up to and including termination ◦ An employee must report observed unethical behavior 82

83. Copyright © 2015 Pearson Education, Inc. 2-83  Code of Ethics: Typical Contents (Partial List) ◦ An employee must involve conflicts of interest  Never exploit one’s position for personal gain  No preferential treatment of relatives  No investing in competitors  No competing with the company while still employed by the firm 83

84. Copyright © 2015 Pearson Education, Inc. 2-84  Code of Ethics: Typical Contents (Partial List) ◦ No bribes or kickbacks  Bribes are given by outside parties to get preferential treatment  Kickbacks are given by sellers when they place an order to secure this or future orders ◦ Employees must use business assets for business uses only, not personal use 84

85. Copyright © 2015 Pearson Education, Inc. 2-85  Code of Ethics: Typical Contents (Partial List) ◦ An employee may never divulge  Confidential information  Private information  Trade secrets 85

86. Copyright © 2015 Pearson Education, Inc. 2-86  Exceptions Are Always Required ◦ But they must be managed  Limiting Exceptions ◦ Only some people should be allowed to request exceptions ◦ Fewer people should be allowed to authorize exceptions ◦ The person who requests an exception must never be authorizer 86

87. Copyright © 2015 Pearson Education, Inc. 2-87  Exception Must be Carefully Documented ◦ Specifically what was done and who did each action  Special Attention Should be Given to Exceptions in Periodic Auditing  Exceptions Above a Particular Danger Level ◦ Should be brought to the attention of the IT security department and the authorizer’s direct manager 87

88. Copyright © 2015 Pearson Education, Inc. 2-88  Oversight ◦ Oversight is a group of tools for policy enforcement ◦ Policy drives oversight, just as it drives implementation  Promulgation ◦ Communicate vision ◦ Training ◦ Stinging employees? 88

89. Copyright © 2015 Pearson Education, Inc. 2-89  Electronic Monitoring ◦ Electronically-collected information on behavior ◦ Widely done in firms and used to terminate employees ◦ Warn subjects and explain the reasons for monitoring 89

90. Copyright © 2015 Pearson Education, Inc. 2-90  Security Metrics ◦ Indicators of compliance that are measured periodically ◦ Percentage of passwords on a server that are crackable, etc. ◦ Periodic measurement indicates progress in implementing a policy 90

91. Copyright © 2015 Pearson Education, Inc. 2-91  Auditing ◦ Samples information to develop an opinion about the adequacy of controls ◦ Database information in log files and prose documentation ◦ Extensive recording is required in most performance regimes ◦ Avoidance of compliance is a particularly important finding 91

92. Copyright © 2015 Pearson Education, Inc. 2-92  Auditing ◦ Internal and external auditing may be done ◦ Periodic auditing gives trends ◦ Unscheduled audits trip up people who plan their actions around periodic audits 92

93. Copyright © 2015 Pearson Education, Inc. 2-93  Anonymous Protected Hotline ◦ Employees are often the first to detect a serious problem ◦ A hotline allows them to call it in ◦ Must be anonymous and guarantee protection against reprisals ◦ Offer incentives for heavily damaging activities such as fraud? 93

94. Copyright © 2015 Pearson Education, Inc. 2-94  Behavioral Awareness ◦ Misbehavior often occurs before serious security breaches ◦ The fraud triangle indicates motive. 94

95. Copyright © 2015 Pearson Education, Inc. 2-95  Vulnerability Tests ◦ Attack your own systems to find vulnerabilities ◦ Free and commercial software ◦ Never test without a contract specifying the exact tests, signed by your superior ◦ The contract should hold you blameless in case of damage 95

96. Copyright © 2015 Pearson Education, Inc. 2-96  Vulnerability Tests ◦ External vulnerability testing firms have expertise and experience ◦ They should have insurance against accidental harm and employee misbehavior ◦ They should not hire hackers or former hackers ◦ Should end with a list of recommended fixes ◦ Follow-up should be done on whether these fixes occurred 96

97. Copyright © 2015 Pearson Education, Inc. 2-97  Sanctions ◦ If people are not punished when they are caught, nothing else matters 97

98. Copyright © 2015 Pearson Education, Inc. 2-98 2.1 Introduction & Terminology 2.2 Compliance Laws and Regulations 2.3 Organization 2.4 Risk Analysis 2.5 Technical Security Architecture 2.6 Policy-Driven Implementation 2.7 Governance Frameworks 98

99. Copyright © 2015 Pearson Education, Inc. 2-99 99 Not included

100. Copyright © 2015 Pearson Education, Inc. 2-100  Origins ◦ Committee of Sponsoring Organizations of the Treadway Commission (www.coso.org) ◦ Ad hoc group to provide guidance on financial controls  Focus ◦ Corporate operations, financial controls, and compliance ◦ Effectively required for Sarbanes–Oxley compliance ◦ Goal is reasonable assurance that goals will be met 100 Not included

101. Copyright © 2015 Pearson Education, Inc. 2-101  Components ◦ Control Environment  General security culture  Includes “tone at the top”  If strong, weak specific controls may be effective  If weak, strong controls may fail  Major insight of COSO 101 Not included

102. Copyright © 2015 Pearson Education, Inc. 2-102  Components ◦ Risk assessment  Ongoing preoccupation ◦ Control activities  General policy plus specific procedures 102 Not included

103. Copyright © 2015 Pearson Education, Inc. 2-103  Components ◦ Monitoring  Both human vigilance and technology ◦ Information and communication  Must ensure that the company has the right information for controls  Must ensure communication across all levels in the corporation 103 Not included

104. Copyright © 2015 Pearson Education, Inc. 2-104  CobiT ◦ Control Objectives for Information and Related Technologies ◦ CIO-level guidance on IT governance ◦ Offers many documents that help organizations understand how to implement the framework 104 Not included

105. Copyright © 2015 Pearson Education, Inc. 2-105  The CobiT Framework ◦ Four major domains ◦ 34 high-level control objectives  Planning and organization (10)  Acquisition and implementation (7)  Delivery and support (13)  Monitoring (4) ◦ More than 300 detailed control objectives 105 Not included

106. Copyright © 2015 Pearson Education, Inc. 2-106  Dominance in the United States ◦ Created by the IT governance institute ◦ Part of the Information Systems Audit and Control Association (ISACA) ◦ ISACA is the main professional accrediting body of IT auditing ◦ Certified information systems auditor (CISA) certification 106 Not included

107. Copyright © 2015 Pearson Education, Inc. 2-107  The CobiT Framework ◦ Four major domains (Figure 2-28) 107 Not included

108. Copyright © 2015 Pearson Education, Inc. 2-108  ISO/IEC 27000 ◦ Family of IT security standards with several individual standards ◦ From the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)  ISO/IEC 27002 ◦ Originally called ISO/IEC 17799 ◦ Recommendations in 11 broad areas of security management 108

109. Copyright © 2015 Pearson Education, Inc. 2-109  ISO/IEC 27002: Eleven Broad Areas 109 Security policyAccess control Organization of information security Information systems acquisition, development and maintenance Asset managementInformation security incident management Human resources securityBusiness continuity management Physical and environmental security Compliance Communications and operations management

110. Copyright © 2015 Pearson Education, Inc. 2-110  ISO/IEC 27001 ◦ Created in 2005, long after ISO/IEC 27002 ◦ Specifies certification by a third party  COSO and CobiT permit only self-certification  Business partners prefer third-party certification  Other 27000 Standards ◦ Many more 27000 standards documents are under preparation 110